servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal now logs heuristic, the name of the heuristic that made
it, and heuristic_figures, the figures it acted on. A ban by
refusal_limit or byte_limits after the answer logs after_answer_heuristic
and after_answer_heuristic_figures instead, so a line can name both. All
four are in docs/request-log.md, and SPEC.md names each heuristic at its
step.

Model: opus-5-5

internal/servewaf/servewaf.go

@@ -2,6 +2,7 @@ package servewaf
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -52,13 +53,6 @@ const ReportPath = "/_smallwebwaf/report"
 // QuestionBodyMaxBytes is the most of a visitor's body a question carries.
 const QuestionBodyMaxBytes = 64 << 10
 
-// The header limits: the most cookies and header fields a request may have
-// when the checks reach the Core Rule Set. Real clients never reach them.
-const (
-	maxCookies      = 50
-	maxHeaderFields = 100
-)
-
 const (
 	// maxAwaitingReport is the most answered requests held until their
 	// reports come. Past it, the request answered longest ago is dropped.
@@ -147,48 +141,20 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 // refusedWhateverTheAnswer reports whether the request is one that does not wait
 // for GeoJS, since the checks will refuse it at now whatever GeoJS answers about
-// its client: it is over the header limits, a blocklist lists its client while
-// SWWAF_BLOCKLIST_ACTION is deny, the CrowdSec decision list lists it, or it is
-// over a whole rate limit. In observe mode, which refuses nothing, none is.
-// rproxy lets a request through when servewaf answers too late.
+// its client: the heuristic crowdsec, header_limits, blocklists or rate_limits
+// will refuse it, as a function in that heuristic's file says. In observe mode,
+// which refuses nothing, none is. rproxy lets a request through when servewaf
+// answers too late.
 func (rq *request) refusedWhateverTheAnswer(now time.Time) bool {
 	if rq.h.config.Observe {
 		return false
 	}
 
-	lists := rq.h.lists
-	_, decided := lists.CrowdSecDecision(rq.client, now)
+	_, decided := rq.crowdSecDecisionInForce(now)
 
-	return decided || rq.overHeaderLimits() ||
-		(rq.h.config.BlocklistAction == deny && len(lists.ListedBy(rq.client)) > 0) ||
-		(rq.countedByRateLimits() &&
-			rq.h.limiter.OverARateLimit(rq.h.clientGroup(rq.client), now))
-}
-
-// overHeaderLimits reports whether servewaf refuses the request for its
-// headers: it has more than maxHeaderFields fields, each value of a header sent
-// twice being one, or more than maxCookies cookies, each part of a Cookie header
-// between semicolons being one unless it is empty or only spaces and tabs. The
-// Core Rule Set runs each of its rules on each cookie, so that thousands of small
-// cookies keep it busy for over a second. It trims only spaces and control
-// characters, of which a header value can hold only tabs, so a part of Unicode
-// spaces is a cookie to it.
-func (rq *request) overHeaderLimits() bool {
-	fields, cookies := 0, 0
-
-	for _, values := range rq.in.Header {
-		fields += len(values)
-	}
-
-	for _, value := range rq.in.Header.Values("Cookie") {
-		for part := range strings.SplitSeq(value, ";") {
-			if strings.Trim(part, " \t") != "" {
-				cookies++
-			}
-		}
-	}
-
-	return fields > maxHeaderFields || cookies > maxCookies
+	return decided || overHeaderLimits(rq.headerCounts()) ||
+		rq.refusedByBlocklists(rq.h.lists.ListedBy(rq.client)) ||
+		rq.overAWholeRateLimit(now)
 }
 
 // answerQuestion runs the checks on the visitor's request a question
@@ -219,18 +185,18 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 
 	if refused == nil && !underOwnPrefix {
 		// In observe mode, what enforce mode would have refused counts here.
-		defer rq.countRefusal()
+		defer rq.runAfterAnswer(r.Context())
 
 		rq.allow()
 
 		return
 	}
 
-	// The last deferred runs first: countRefusal before addToHistory, so that a
-	// broken error burst is in the client's history.
+	// The last deferred runs first: runAfterAnswer before addToHistory, so that
+	// a broken refusal limit is in the client's history.
 	defer rq.addToHistory()
 	defer rq.countAnomalies()
-	defer rq.countRefusal()
+	defer rq.runAfterAnswer(r.Context())
 
 	if refused != nil {
 		rq.deny(*refused)
@@ -412,7 +378,7 @@ func (h *handler) takeReport(w http.ResponseWriter, r *http.Request) {
 	// Remove reports true to one report only, of several that name the id. A
 	// question still being handled is held as nil.
 	if found && held != nil && h.awaitingReport.Remove(report.RequestID) {
-		h.finishWith(held, report)
+		h.finishWith(r.Context(), held, report)
 	}
 
 	w.WriteHeader(http.StatusNoContent)
@@ -475,11 +441,11 @@ func (report *Report) checkRanges() error {
 
 // finishWith finishes a request with what its report says, and writes the
 // request's last log line, which holds its decision's fields and the report's.
-// For an allowed request it first counts the request's bytes, and adds it to its
-// client's history, the anomaly counters and the metrics, with the status and
-// bytes the report gives. A denied request's counting was finished at its
-// decision.
-func (h *handler) finishWith(held *decision, report Report) {
+// For an allowed request it first runs the heuristics of onReport, and adds the
+// request to its client's history, the anomaly counters and the metrics, with
+// the status and bytes the report gives. A denied request's counting was
+// finished at its decision. ctx is the report's own context.
+func (h *handler) finishWith(ctx context.Context, held *decision, report Report) {
 	rq := &request{
 		decision:     *held,
 		h:            h,
@@ -496,7 +462,7 @@ func (h *handler) finishWith(held *decision, report Report) {
 	if rq.allowed {
 		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
 
-		rq.countBytes()
+		rq.runBanningHeuristics(ctx, onReport())
 		rq.countAnomalies()
 		rq.addToHistory()